From owner-freebsd-net@freebsd.org Mon Aug 31 04:05:33 2015 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 754449C6DCF for ; Mon, 31 Aug 2015 04:05:33 +0000 (UTC) (envelope-from btw@mail.ustc.edu.cn) Received: from ustc.edu.cn (email6.ustc.edu.cn [IPv6:2001:da8:d800::8]) by mx1.freebsd.org (Postfix) with ESMTP id 3A84E2B2; Mon, 31 Aug 2015 04:05:31 +0000 (UTC) (envelope-from btw@mail.ustc.edu.cn) Received: from dell.my.domain (unknown [182.112.28.20]) by newmailweb.ustc.edu.cn (Coremail) with SMTP id LkAmygBnVwiE0uNVrLalAA--.7299S2; Mon, 31 Aug 2015 12:05:28 +0800 (CST) From: Tiwei Bie To: freebsd-net@freebsd.org Cc: adrian@freebsd.org, hiren@freebsd.org Subject: A bug in udp6_input() - should use proto instead of ip6->ip6_nxt Date: Mon, 31 Aug 2015 12:05:49 +0800 Message-Id: <1440993949-20698-1-git-send-email-btw@mail.ustc.edu.cn> X-Mailer: git-send-email 2.4.6 X-CM-TRANSID: LkAmygBnVwiE0uNVrLalAA--.7299S2 X-Coremail-Antispam: 1UD129KBjvJXoW7ZryDCw43Ww1UJw1DuFy5twb_yoW8Ww43pa y3JryDWa1UJrnrCr4Ikr4UWr4rGrs8C3yfuw4avry0kFW29r18tFWkJF4akrW8G3Wj93yY 9Fnxt3y5C3s7X3DanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUyIb7Iv0xC_KF4lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2F7IY1VAKz4vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Ar0_tr1l84ACjcxK6xII jxv20xvEc7CjxVAFwI0_Cr0_Gr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I 8E87Iv6xkF7I0E14v26rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI 64kE6c02F40Ex7xfMcIj6xIIjxv20xvE14v26r106r15McIj6I8E87Iv67AKxVWUJVW8Jw Am72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41l42xK82IYc2Ij64vIr41l4I8I 3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxV WUGVWUWwC2zVAF1VAY17CE14v26r1Y6r17MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAF wI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r1j6r4UMIIF0xvE42xK8VAvwI8IcI k0rVW3JVWrJr1lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVWU JVW8JbIYCTnIWIevJa73UjIFyTuYvjxU2cdbUUUUU X-CM-SenderInfo: xewzqzxdloh3xvwfhvlgxou0/1tbiAQYRAVQhmDZvLQAQse X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Aug 2015 04:05:33 -0000 I found a bug in udp6_input(). The 'proto' parameter should be used to get the protocol number (UDP or UDPLITE), instead of ip6->ip6_nxt. Because ip6->ip6_nxt may be the protocol number of extension header, such as: If a UDP packet is an "atomic" fragment, frag6_input() will return directly, and ip6->ip6_nxt will be IPPROTO_FRAGMENT (if the first extension header is the fragment header) instead of IPPROTO_UDP or IPPROTO_UDPLITE: int frag6_input(struct mbuf **mp, int *offp, int proto) { ...... /* * RFC 6946: Handle "atomic" fragments (offset and m bit set to 0) * upfront, unrelated to any reassembly. Just skip the fragment header. */ if ((ip6f->ip6f_offlg & ~IP6F_RESERVED_MASK) == 0) { /* XXX-BZ we want dedicated counters for this. */ IP6STAT_INC(ip6s_reassembled); in6_ifstat_inc(dstifp, ifs6_reass_ok); *offp = offset; return (ip6f->ip6f_nxt); } And this is the patch to fix this bug: diff --git a/sys/netinet6/udp6_usrreq.c b/sys/netinet6/udp6_usrreq.c index 98790a8..da72f00 100644 --- a/sys/netinet6/udp6_usrreq.c +++ b/sys/netinet6/udp6_usrreq.c @@ -207,7 +207,7 @@ udp6_input(struct mbuf **mp, int *offp, int proto) struct sockaddr_in6 fromsa; struct m_tag *fwd_tag; uint16_t uh_sum; - uint8_t nxt; + uint8_t nxt = proto; ifp = m->m_pkthdr.rcvif; ip6 = mtod(m, struct ip6_hdr *); @@ -233,7 +233,6 @@ udp6_input(struct mbuf **mp, int *offp, int proto) plen = ntohs(ip6->ip6_plen) - off + sizeof(*ip6); ulen = ntohs((u_short)uh->uh_ulen); - nxt = ip6->ip6_nxt; cscov_partial = (nxt == IPPROTO_UDPLITE) ? 1 : 0; if (nxt == IPPROTO_UDPLITE) { /* Zero means checksum over the complete packet. */ Best regards, Tiwei Bie